Last updated: November 10, 2026. This Privacy Policy explains what personal data Excel Corner collects through excelcorner.com, why, who receives it, how long we keep it and what rights you have. Read it together with our Cookie Policy and our Legal Notice (Impressum) and Terms of Use.
1. Who is responsible for your data
The controller of the personal data processed through the website https://excelcorner.com (the “Website”) is Sergio Jiménez Canales, an individual operating as a sole proprietor (Einzelunternehmer) under the trade name Excel Corner (“Excel Corner”, “we”, “us” or “our”).
| Controller details | |
|---|---|
| Name | Sergio Jiménez Canales |
| Trade name | Excel Corner |
| Address | Gartenstraße 22a, 26122 Oldenburg, Lower Saxony, Germany |
| [email protected] | |
| Phone | +34 680 101 699 |
| VAT ID (USt-IdNr.) | DE459854068 |
| Website | https://excelcorner.com |
We are established in Germany, so the General Data Protection Regulation (EU) 2016/679 (“GDPR”), the German Federal Data Protection Act (BDSG) and the German Telecommunications Digital Services Data Protection Act (TDDDG) apply to us. We also describe your rights under US state privacy laws in section 8, because most of our visitors are in the United States.
We have not appointed a data protection officer because the law does not require it for our activity. For anything related to your data, write to the email address above.
2. The short version
- Excel Corner offers free Excel templates. You do not need an account, and we do not ask for your email address to download anything.
- The numbers and names you type into a template stay in your own file. We never receive them.
- We only collect personal data when you send us a message with the contact form or by email, plus the technical data that our web server and our security provider receive when you load a page.
- We do not sell your personal data and we do not share it for advertising. Today the Website uses no advertising, no analytics and no tracking cookies.
- You can ask us to access, correct or delete your data at any time at [email protected].
3. What data we process, why, and on what legal basis
The table below lists every processing activity on the Website today. We do not use the data for any other purpose.
| Activity | Data | Purpose | Legal basis | How long we keep it |
|---|---|---|---|---|
| Contact form | Name, email address, topic, optional template page address, your message, and confirmation that you accepted this policy. The form plugin also stores technical details sent by your browser: IP address, browser (user agent), the page you were on, and date and time. | Read and answer your message, handle template requests and problem reports, keep a record of the conversation. | Your consent (art. 6.1.a GDPR), given when you tick the box and send the form. | Up to 24 months after our last exchange, then deleted. Longer only where the law requires it or to defend legal claims (see below). |
| Emails you send us directly | Your name, email address and the content of your email. | Answer your email. | Our legitimate interest in answering the people who contact us (art. 6.1.f GDPR). | Up to 24 months after our last exchange. |
| Server and security logs | IP address, requested address (including any words you type in the search box when you submit a search), browser, referring page, date and time, response status. | Deliver the Website, keep it secure, detect abuse and attacks, fix errors. | Our legitimate interest in running a secure and working website (art. 6.1.f GDPR). | Set by our hosting and security providers, normally days to a few months. |
| Search suggestions | The letters you type in the search box are sent to our own server to suggest templates. They are not linked to you and we do not store them in our database. | Show template suggestions while you type. | Our legitimate interest in providing a usable search (art. 6.1.f GDPR). | Only inside the server logs described above. |
| Content delivery and security (Cloudflare) | IP address, request details and security signals such as whether a request looks automated. | Speed up the Website and protect it from attacks and bots. | Our legitimate interest in security and performance (art. 6.1.f GDPR). | As set by Cloudflare, Inc. |
| Rights requests and legal claims | The data needed to identify you and answer your request, and the record of the answer. | Comply with the law and defend ourselves against claims. | Legal obligation (art. 6.1.c) and legitimate interest (art. 6.1.f). | For the legal limitation periods. |
Providing the data marked in the contact form is voluntary, but without your name, email address and message we cannot answer you.
Messages that are commercial correspondence, for example a request or an offer that leads to a business relationship, are kept for the statutory retention periods of German commercial and tax law, which are generally six years (section 257 of the German Commercial Code, section 147 of the German Fiscal Code).
4. What we do not collect
- We do not offer accounts, comments, a newsletter, memberships or payments, so we do not collect data for them.
- We do not use advertising or analytics services, social media pixels or session recording tools.
- We do not knowingly collect sensitive data (health, political opinions, religion, biometric data and similar), and we ask you not to send it to us.
- We do not load fonts, scripts or images from third-party servers. The fonts are hosted on our own server, so showing the Website does not send your IP address to Google or to any other font provider.
- We do not receive the information you enter in the templates. They are plain .xlsx files that run on your computer.
- We do not make decisions about you by automated means or build profiles about you.
5. Who receives your data
We do not sell or rent your personal data. We only share it with the service providers we need to run the Website. Some act on our instructions as processors, and others, such as our security provider, run their own services:
| Recipient | What they do | Data involved |
|---|---|---|
| Our web hosting provider | Hosts the Website, the database and the contact form messages, and delivers the email notifications. | Everything described in section 3. |
| Cloudflare, Inc. (United States) | Content delivery network and security layer in front of the Website. | IP address and request details. |
| Our email provider | Receives the notifications and emails sent to [email protected]. | Contact form content and your emails. |
| Public authorities, courts and professional advisers (for example tax advisers) | Only when the law requires it or to establish, exercise or defend legal claims. | The data strictly needed. |
Excel and Microsoft are trademarks of Microsoft Corporation. We are not affiliated with Microsoft or Cloudflare, and neither has access to the content of your templates.
6. International transfers
We are based in Germany and process your data in the European Economic Area. Cloudflare is a US company and may process the technical data described above in the United States and other countries. Where that happens we rely on the safeguards the provider offers, such as the EU-US Data Privacy Framework (for certified companies) or the European Commission’s Standard Contractual Clauses.
If you visit from the United States or any other country, your data is processed in Germany and the other countries mentioned here. You can ask us for details about the safeguards at [email protected].
7. Your rights under the GDPR (EEA, UK and Switzerland)
Whatever country you are in, we apply these rights to everyone who asks:
- Access the personal data we hold about you and receive a copy.
- Rectify data that is inaccurate or incomplete.
- Erase your data (“right to be forgotten”) when there is no reason to keep it.
- Restrict the processing in the cases set out by law.
- Object to processing based on our legitimate interest.
- Data portability for data you gave us on the basis of consent, in a common electronic format.
- Withdraw your consent at any time. Withdrawal does not affect processing done before it.
- Not be subject to automated decisions. We do not make any.
To exercise a right, write to [email protected] with the subject “Privacy request” and tell us what you need. We may ask you for information to confirm who you are. We answer within one month, which we can extend by two further months for complex requests, and we will tell you if we do. Exercising your rights is free, unless a request is clearly unfounded or excessive.
If you think we have not handled your data properly you can complain to the data protection authority responsible for us, Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, www.lfd.niedersachsen.de, or to the authority of the country where you live or work. We would appreciate the chance to fix the problem first.
8. Notice for US residents
This section applies in addition to the rest of the policy if you live in a US state with a comprehensive privacy law, such as California, Colorado, Connecticut, Virginia, Texas, Oregon or Utah. We give these rights to all US visitors, whether or not a law legally requires us to.
Categories of personal information in the last 12 months
| Category | Examples | Source | Why we use it | Disclosed to |
|---|---|---|---|---|
| Identifiers | Name, email address, IP address | You (contact form, email) and your browser | Answer you, keep the Website secure | Hosting, email and security providers (service providers) |
| Internet or network activity | Pages requested, search words submitted, browser type, date and time | Your browser | Security and operation of the Website | Hosting and security providers |
| Communications | Content of the messages you send us | You | Answer you | Hosting and email providers |
| Sensitive personal information | None collected | Not applicable | Not applicable | Not applicable |
- We do not sell and we do not share your personal information for cross-context behavioral advertising, and we have not done so in the past 12 months. We do not knowingly sell or share the personal information of anyone under 16.
- Your rights: to know what we collect, use and disclose; to access and receive a copy; to correct; to delete; to opt out of sale, sharing and targeted advertising (we do none); to limit the use of sensitive information (we use none); and not to be discriminated against for using your rights.
- How to ask: email [email protected] with the subject “Privacy request”. We confirm receipt and normally respond within 45 days, and we can extend that once when the law allows it.
- Verification and agents: we may ask you to confirm the email address you wrote from. An authorized agent can send a request with written proof of your permission.
- Appeals: if we refuse your request you can reply to our answer to appeal, and we will respond in writing within the time set by your state law. You can also contact your state attorney general.
- California “Shine the Light”: we do not disclose personal information to third parties for their direct marketing purposes.
- Nevada: we do not sell covered information as defined by Nevada law.
9. Do Not Track and Global Privacy Control
The Website does not track you across other sites, so there is nothing to switch off. We treat a Global Privacy Control signal or a Do Not Track setting as a request not to sell, share or track your data, and as explained above we already do none of those things. If we add technologies that need your consent in the future, we will honor those signals and ask you first.
10. Cookies and similar technologies
At the date of this policy the Website does not set advertising, analytics or other non-essential cookies for visitors. Security services in front of the Website may set a technical cookie when they need to check that a visitor is not an automated program. You will find the details, the list of cookies and how to manage them in our Cookie Policy.
11. Children
The Website is intended for a general audience and is not directed at children. We do not knowingly collect personal data from anyone under 16 years old (under 13 for the purposes of the US Children’s Online Privacy Protection Act). If you believe a child has sent us personal data, write to [email protected] and we will delete it.
12. Security and data breaches
We apply reasonable technical and organizational measures to protect the data we hold, such as encrypted connections (HTTPS), restricted access to the administration area, keeping the software up to date and limiting the data we collect. No system is completely secure. If a breach puts your rights and freedoms at risk we will notify the competent data protection authority within 72 hours, and we will tell you directly when the law requires it.
13. Links to other websites
Some pages link to websites we do not control, for example Microsoft documentation or government sites. This policy does not apply to them, and we recommend that you read their privacy policies.
14. Changes to this policy
We update this policy when the Website or the law changes, and the date at the top shows the latest version. If we introduce anything that is not described here, such as web analytics, advertising, a newsletter or user accounts, we will update this policy before we start. Where the law requires it we will ask for your consent first, for example with a cookie banner that lets you accept or refuse each category.
15. Contact
Questions about this policy or about your data: [email protected], or by post to Sergio Jiménez Canales, Gartenstraße 22a, 26122 Oldenburg, Lower Saxony, Germany. You can also use the contact form on our home page.